Before the FEDERAL COMMUNICATIONS COMMISSION Washington, D.C

Transcription

1 Before the FEDERAL COMMUNICATIONS COMMISSION Washington, D.C. 000 In the Matter of ) ) EPIC Et Al. Petition for Rulemaking to Repeal ) WC Docket No C.F.R..6 ( Retention of Telephone Records ) ) Comments of Consumers Union Katie McInnis Consumers Union th St NW, Suite 00 Washington, D.C. 006 (0) 6-66 June 16, 017 1

2 1 Consumers Union, the policy and mobilization arm of Consumer Reports, appreciates this opportunity to comment in support of the petition from EPIC et al. for a rulemaking to repeal 7 C.F.R..6. Our comments below highlight the sensitive nature of the data collected and retained under Section.6, how the rule is unnecessary for business purposes, how the rule no longer serves a necessary law enforcement purpose, and finally how the rule makes the consumer data vulnerable to a breach. Under Section.6, telephone companies are required to retain 18 months of sensitive consumer data. Section.6 states: Each carrier that offers or bills toll telephone service shall retain for a period of 18 months such records as are necessary to provide the following billing information about telephone toll calls: the name, address, and telephone number of the caller, telephone number called, date, time, and length of the call. Each carrier shall retain this information for toll calls that it bills whether it is billing its own toll service customers for toll calls or billing customers for another carrier. Ninety-five percent of Americans own a cellphone of some kind. The high rate of cellphone use means that the Commission requires telephone companies to keep 18 months of call data on at least 9 percent of the population. Meanwhile, the law enforcement and commercial justifications for this rule have significantly eroded, as discussed below. Further, Section.6 necessitates that telephone companies keep a vast and detailed history of a consumer s telephone use even in cases where the consumer is under no suspicion of wrongdoing. A call history record can reveal sensitive aspects of a consumer s life, including close relationships between family, friends, and colleagues, and the possibly confidential relationships between an individual and their attorneys, doctors, and elected representatives. The Digital Testing Standard, which we recently launched in collaboration with several 1 Consumers Union is an expert, independent, nonprofit organization whose mission is to work for a fair, just, and safe marketplace for all consumers and to empower consumers to protect themselves. It conducts this work in the areas of privacy, financial services reform, food and product safety, telecommunications reform, health care reform, and other areas. Consumer Reports is the world s largest independent product-testing organization. Using its more than 0 labs, auto test center, and survey research center, the nonprofit organization rates thousands of products and services annually. Founded in 196, Consumer Reports has over 8 million subscribers to its magazine, website, and other publications. EPIC, Petition to Repeal 7 C.F.R..6 ( Retention of Telephone Records ) (Aug., 01), FCC Retention of Telephone Toll Records, 7 C.F.R..6. Mobile Technology Fact Sheet, PEW RESEARCH CENTER, (last visited June 1, 017) (stating that as of 016, 9% of Americans own a cell phone). The Digital Testing Standard (thedigitalstandard.org) was launched on March 6th, 017 and is the result of a collaboration with our cybersecurity partners, Disconnect, Ranking Digital Rights, and the Cyber Independent Testing Lab. The Standard is an evolving set of criteria that is being refined through comments and testing. The Standard is designed to hold companies accountable and equip Consumer Reports and other organizations to test and rate products for how responsibly they handle our private data. This is a collaborative and open source effort. The Standard is designed to empower consumers to make informed choices about the connected products,

3 partners, includes within it the requirement that companies practice minimal data collection. 6 This basic privacy concept, which is found in privacy regimes worldwide, means that the information collected from the user is limited to data that is directly relevant and necessary for the service. The telephone retention rule requires telecommunications companies to retain data about individuals that is not necessary to serve the consumer. In addition, the retention of this data contravenes another principle in the Digital Standard: my account and information are 7 deleted when I leave the service. Under Section.6, consumers can cancel their service contract with their telephone service provider but their data will not be deleted, if at all, for another 18 months. This practice is contrary to what reasonable consumers would expect when they cancel a service and renders the consumer vulnerable to data breaches. Ironically, the concerned consumer who wishes to change telephone companies, possibly due to concerns about that company s data practices, remains powerless to protect his or her data for a full 18 months afterwards. In addition to concerns about consumer expectations, call record information is currently retained for far longer than necessary for business purposes. The retention rule is based on an outdated billing and service model. Back in 198 when when this rule was enacted, phone plans were measured and non-bundled. The retention of records for some period of time was necessary for accurately billing the user of the service. However, telephone service carriers have moved away from classic billing models, in which charges are itemized, and currently use 8 non-measured, bundled, and flat-rate service plans. Additionally, some carriers have claimed that call records under such new plans not covered by Section.6 because they are not toll 9 records. Modern telephone plans are non-measured and bundled, making the retention rule unnecessary to serve the consumer. Even in 198, the Federal Communications Commission (FCC) considered rolling back the requirement that telecommunications companies retain call record data for six months. Indeed, the Commission initiated a rulemaking to remove this burdensome record-keeping 10 requirement. At that time, however, the FCC faced opposition from the Department of Justice apps, and services consumers use everyday C.F.R. 1., see also FTC Privacy Report, FED. TRADE COMM N, (last visited June 16, 017). 7 The Standard, THE DIGITAL STANDARD, (last visited June 16, 017). 8 Dept. of Justice and Homeland Security, Comment Letter on Notice of Rulemaking In the Matter of Implementation of the Telecommunications Act of 1996, at 11-1 (Apr. 8, 006), CC Docket No [hereinafter, DOJ CPNI Petition]. 9 Id. at 11-1; See also Fed. Bureau of Investigation Memorandum Opinion for the General Counsel on Information Under the Elec. Comm. Privacy Act (Nov., 008) at 6 (explaining the historical definition and difference between local and long distance toll within the communication industry). Historically, local calls did not incur a toll, but long distance calls did. Telephone toll service in the Communications Act is defined as telephone service between stations in different exchange areas for which there is made a separate charge not included in contracts with subscribers for exchange service. 7 U.S.C. 1 (). 10 Preservation of Records of Communications Common Carriers, 0 Fed. Reg. 1,9, 1,9 (proposed Aug., 198) [hereinafter Preservation of Records 198]. See also Preservation of Records of Communication Common Carriers, 8 Fed. Reg. 1,00, 1,09 (Dec., 196) [hereinafter Preservation of Records 196] (in which the FCC orders the 6-month retention to provide the basis of charges to subscribers. ).

4 (DOJ). The DOJ supported the long retention requirement because telephone toll records are often essential to the successful investigation and prosecution of today s sophisticated criminal 11 conspiracies On the other hand, telecommunications companies supported the proposed rule because (1) the elimination of the retention period would allow phone companies to develop 1 cost efficient recordkeeping systems, () a six-month retention period would seem adequate 1 for most records, and () if law enforcement agencies needed call records for an investigation 1 they could request that records be maintained for individuals currently under investigation. Despite opposition from the phone companies, the Commission adopted the 18-month retention rule. However, the retention rule, even if necessary in 198 for law enforcement purposes, is not necessary in 017. Eleven years ago, in 006, the DOJ stated: the efficacy of the Commission s current Section.6 requirement to meet law enforcement needs has been 1 significantly eroded. Since then, telephone technology and law enforcement practices have evolved dramatically so that, even if this data retention rule is successfully repealed, law enforcement can still contact telephone companies and request the retention of call information for individuals under suspicion. In addition, the rule prevents consumers from exercising control over their personal call data and renders the consumer vulnerable to a breach of their call data. The retention of sensitive phone records increases the likelihood of large-scale data breaches like the Office of Personnel Management (OPM) data breach in 01. That breach affected 1. million individuals and revealed personal information like the background investigations of prospective, current, and 16 former Federal employees and contractors. In November of 01, another major data breach was discovered when materials were leaked to a news source. Securus Technologies, a provider of phone services to inmates in prisons and jails in the United States, experienced a breach that 17 revealed over 70 million call records that spanned a nearly two-and-a-half year period. Data minimization is a necessary protection against harmful breaches of personal consumer data. No matter how many procedures a company implements to protect its servers, the very existence of 18 months of detailed and personal call data renders a consumer s call information vulnerable to attack. Such information is a treasure trove for hackers seeking valuable consumer data. In today s world, telephone companies should be encouraged, not prohibited from, practicing sensible data minimization practices. In addition, telephone providers should be allowed and encouraged to compete on the basis of the privacy and security they 11 Preservation of Records 198, supra note 10, at 1,97. 1 In the Matter of: Revision of Part, Pres. of Records of Commc'n Common Carriers, 60 Rad. Reg. d (P & F) 19 at (F.C.C. Aug., 1986) [hereinafter In the Matter of: Revision of Part ]. 1 Preservation of Records 198, supra note 10, at 1,96. 1 In the Matter of: Revision of Part, supra note 1, at. 1 DOJ CPNI Petition, supra note 8, at Information About OPM Cybersecurity Incidents, OPM.GOV, (last visited June 1, 017). 17 Jordan Smith & Micah Lee, Not So Securus, THE INTERCEPT (Nov. 11, 01), lients/.

5 afford to their call data. Respectfully submitted, Katie McInnis Staff Attorney Consumers Union